Allow device admin policy to override policy boolean state.

Prior code only allowed a false to true transition for a device
admin policy. This was to ensure that a default true was always
upheld. Reverse this and allow a device admin policy to take over
the setting of all booleans; even those set by the init.rc.

Change-Id: I64ae4d397a8118614c83fa611f0191e2f934dade
Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>

1 files changed, 8 insertions, 10 deletions

diff --git a/services/java/com/android/server/DevicePolicyManagerService.java b/services/java/com/android/server/DevicePolicyManagerService.java
index df50a5e..911b889 100644
--- a/services/java/com/android/server/DevicePolicyManagerService.java
+++ b/services/java/com/android/server/DevicePolicyManagerService.java
@@ -2715,16 +2715,14 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
         for (String sebool : sebools) {
             systemState = SELinux.getBooleanValue(sebool);
             desiredState = selinuxAdmin.sebools.get(sebool);
-            if (!firstBoot || !systemState) {
-                if (systemState != desiredState) {
-                    Slog.v(TAG, "SELinux boolean [" + sebool + "] : " + systemState + " -> " + desiredState);
-                    boolean res = SELinux.setBooleanValue(sebool, desiredState);
-                    Slog.v(TAG, "SELinux boolean " + sebool + " " + (res ? "succeeded" : "failed"));
-                    if (res == false) {
-                        // this really shouldn't ever happen
-                        resetSELinuxAdmin(selinuxAdmin);
-                        return false;
-                    }
+            if (systemState != desiredState) {
+                Slog.v(TAG, "SELinux boolean [" + sebool + "] : " + systemState + " -> " + desiredState);
+                boolean res = SELinux.setBooleanValue(sebool, desiredState);
+                Slog.v(TAG, "SELinux boolean " + sebool + " " + (res ? "succeeded" : "failed"));
+                if (res == false) {
+                    // this really shouldn't ever happen
+                    resetSELinuxAdmin(selinuxAdmin);
+                    return false;
                 }
             }
         }